Is CVE-2026-109374 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109374 being exploited in the wild.

How severe is CVE-2026-109374?

Medium severity, with a CVSS score of 5.5, published 12 October 2026.

Which products and versions are affected?

ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.19.1.

How is CVE-2026-109374 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109374?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109374: ZITADEL privilege escalation in OIDC token exchange

CVE-2026-109374 · Severity: medium · CVSS 5.5 · Published 2026-10-12

ZITADEL is an open-source identity and access management platform that provides authentication and authorization services for applications. A vulnerability in its OIDC token exchange mechanism allows users with limited "end-user impersonator" roles to impersonate administrators, including instance owners, and sign into applications with elevated privileges. This could give attackers access to administrative functions and sensitive data within any application relying on the ZITADEL instance for authentication.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-109374 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109374 being exploited in the wild.
How severe is CVE-2026-109374?: Medium severity, with a CVSS score of 5.5, published 12 October 2026.
Which products and versions are affected?: ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.19.1.
Is there a fix for CVE-2026-109374?: Yes: fixed in ZITADEL 4.19.2 and later (3.x reached end-of-life and will not receive a fix). Until then: Disable the IAM_END_USER_IMPERSONATOR and ORG_END_USER_IMPERSONATOR roles, or disable impersonation in the instance security settings, until an upgrade to version 4.19.2 or later is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109374 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109374?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ZITADEL 4.19.2 and later (3.x reached end-of-life and will not receive a fix)

Disable the IAM_END_USER_IMPERSONATOR and ORG_END_USER_IMPERSONATOR roles, or disable impersonation in the instance security settings, until an upgrade to version 4.19.2 or later is possible.

Technical details

The OIDC token exchange implementation fails to enforce the admin.impersonation permission when impersonating users, only checking the basic impersonation permission. Users holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can bypass the admin.impersonation check and exchange tokens to impersonate any user, including administrators with IAM_OWNER or ORG_OWNER memberships. The impersonated tokens are marked and rejected by ZITADEL's own APIs but are accepted by relying applications, limiting impact to those applications' authorization scopes.

Affected products

ZITADEL ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.19.1

Timeline

2026-09-28: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.